Yes it will also log failed attempts. ... View more

The IronPort appliance already does cache the ldap lookups and it's configurable to how many entries it should cache and how long should retain the cache. so under the "System Administration" > "LDAP" click to anyone of your ldap profile to edit then click on the word "Advanced". There you will see the "Cache TTL" and Maximum Retain Cache Entries". Hope that helps! ... View more

There is something similar on the testing phase and there is a big maybe doesn't mean that it'll make it. On the other hand looking up the limitation for postfix and this "call ahead" feature will make anyone think twice for using it. This is from POSTFIX site: Limitations of address verification When verifying a remote address, Postfix probes the nearest MTA for that address, without actually delivering mail to it. If the nearest MTA accepts the address, then Postfix assumes that the address is deliverable. In reality, mail for a remote address can bounce AFTER the nearest MTA accepts the recipient address. Some sites may blacklist you when you are probing them too often (a probe is an SMTP session that does not deliver mail), or when you are probing them too often for a non-existent address. This is one reason why you should use sender address verification sparingly, if at all, when your site receives lots of email. Normally, address verification probe messages follow the same path as regular mail.  However, some sites send mail to the Internet via an intermediate relayhost; this breaks address verification.  See below, section "Controlling the routing of address verification probes", for how to override mail routing and for possible limitations when you have to do this. Postfix assumes that an address is undeliverable when the nearest MTA for the address rejects the probe, regardless of the reason for rejection (client rejected, HELO rejected, MAIL FROM rejected, etc.).  Thus, Postfix rejects mail when the sender's MTA rejects mail from your machine.  This is a good thing. Unfortunately, some major sites such as YAHOO do not reject unknown addresses in reply to the RCPT TO command, but report a delivery failure in response to end of DATA after a message is transferred.  Postfix address verification does not work with such sites. By default, Postfix probe messages have "double-bounce@$myorigin" as the sender address (with Postfix versions before 2.5, the default is "postmaster@$myorigin"). This is SAFE because the Postfix SMTP server does not reject mail for this address. You can change this into the null address ("address_verify_sender ="). This is UNSAFE because address probes will fail with mis-configured sites that reject MAIL FROM:  <>, while probes from "postmaster@$myorigin" would succeed. YIKES!!!  I don't want to be black listed... Plus there is mention of 6 seconds delay per recipent validation the first time around...without too much dive into this... I would raise a flag of caution... On IronPort side of things...stay tuned..   that's my two cents   ... View more

CLI example: Fri Jan 29 09:28:27 2010 Info: PID 93074: User admin login from 192.168.3.56 on 10.92.152.77 GUI example: Fri Jan 29 15:30:19 2010 Info: req:192.168.3.56 user:- id:eKV0321MgmA92WAlrkJb 200 GET /login HTTP/1.1 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 ... View more

Hello Robert, You are correct. ... View more

All logs via the CLI are logged in cli_logs. All GUI logs are logged in gui_logs.  From what I gather,   you are looking is in either one of the two gui_logs or cli_logs. If someone was trying to attempt to login to the appliance. The Authentication log only will display if it was successful or not and the details of access via GUI and CLI are logged as I mentioned above. ... View more

So are you referring to the user authentication log when one tries to connect to the IronPort GUI? If that is so the gui_logs show the detail whom tried to login and from where?  Can  you give me more details as to which log your referring to? ... View more

If you are referring to the SMTP authentication (which can also use LDAP) the connecting source would look as follows: Authentication attempts made during inbound connections (in order to gain relay access) are logged in the mail_logs when successful and unsuccessful. All relevant entries will be associated with the ICID in question. Successful: Wed Apr 22 11:43:59 2009 Info: New SMTP ICID 450 interface IncomingMail (172.16.155.16) address 172.16.155.102 reverse dns host unknown verified no Wed Apr 22 11:43:59 2009 Info: ICID 450 ACCEPT SG None match ALL SBRS None Wed Apr 22 11:44:48 2009 Info: SMTP Auth: (ICID 450) succeeded for user: ironport using AUTH mechanism: PLAIN with profile: IncomingAuthentication Wed Apr 22 11:46:14 2009 Info: ICID 450 close Unsuccessful: Wed Apr 22 11:47:30 2009 Info: New SMTP ICID 451 interface mail (172.16.155.16) address 172.16.155.102 reverse dns host unknown verified no Wed Apr 22 11:47:30 2009 Info: ICID 451 ACCEPT SG None match ALL SBRS None Wed Apr 22 11:47:47 2009 Info: SMTP Auth: (ICID 451) failed for user: ironport using AUTH mechanism: PLAIN with profile: IncomingAuthentication Wed Apr 22 11:47:56 2009 Info: ICID 451 close Outbound SMTP Authentication When SMTP authentication is required for deliveries to a specific host (configured via an "Outgoing" SMTP authentication profile and an SMTP route referencing said profile), both successful and unsuccessful authentication attempts will be logged in the mail_logs. All entries will be associated with the DCID in question. Successful: Wed Apr 22 11:06:20 2009 Info: New SMTP DCID 5633 interface 172.16.155.16 address 172.16.155.102 port 25 Wed Apr 22 11:06:20 2009 Info: DCID: 5633 IP: 172.16.155.102 SMTP authentication using the profile OutboundAuthentication succeeded. Wed Apr 22 11:06:20 2009 Info: Delivery start DCID 5633 MID 441 to RID [0] Wed Apr 22 11:06:20 2009 Info: Message done DCID 5633 MID 441 to RID [0] Wed Apr 22 11:06:25 2009 Info: DCID 5633 close Unsuccessful: Wed Apr 22 11:19:39 2009 Info: New SMTP DCID 5640 interface 172.16.155.16 address 172.16.155.102 port 25 Wed Apr 22 11:19:41 2009 Info: DCID: 5640 IP: 172.16.155.102 SMTP authentication using the profile OutboundAuthentication failed: ('535', ['5.7.8 Error: authentication failed: authentication failure']) Wed Apr 22 11:19:41 2009 Info: Delivery start DCID 5640 MID 448 to RID [0] Wed Apr 22 11:19:41 2009 Info: Bounced: DCID 5640 MID 448 to RID 0 - Bounced by destination server with response: 5.1.0 - Unknown address error ('554', ['5.7.1 <postmaster@example.com>: Relay access denied']) Wed Apr 22 11:19:46 2009 Info: DCID 5640 close ... View more